AP Cybersecurity Unit 5 flashcards: Securing Applications and Data

Question 1

Administrative privileges

Accepted Answer

Admin accounts can change system settings and reach almost any file. If a regular user has admin rights and is compromised, so is the whole system.

Question 2

Data validation

Accepted Answer

Checking that user input matches what's expected, like a number for a quantity, and rejecting anything else before processing it.

Question 3

SQL injection

Accepted Answer

Putting SQL commands and control characters into an input field so the database returns too much data or changes or deletes data.

Question 4

Cross-site scripting (XSS)

Accepted Answer

Injecting malicious code into a website so visitors' browsers run it. It can reach data stored in the browser, like logins.

Question 5

Reflected vs. stored XSS

Accepted Answer

Reflected (Type I) XSS hides the code in a link the victim clicks. Stored (Type II) XSS saves it on the site, like in a comment, so every visitor runs it.

Question 6

Buffer overflow

Accepted Answer

Sending more data than a fixed-size memory buffer holds, so it spills into nearby memory. It can crash a system or run unauthorized code.

Question 7

Directory traversal

Accepted Answer

Changing a URL or GET request with ../ sequences to climb out of the web folder and reach sensitive files on the server.

Question 8

Data states

Accepted Answer

At rest (stored on a drive), in transit (moving between devices) and in use (being processed). Data must be decrypted to be used.

Question 9

Personally identifiable information (PII)

Accepted Answer

Data that can identify a person, like name, address, Social Security number, birthdate or email. Protected by laws like the Privacy Act of 1974.

Question 10

Protected health information (PHI)

Accepted Answer

Data about a person's health, treatment or health care payments, like test results. Protected under HIPAA (1996).

Question 11

Payment card information (PCI)

Accepted Answer

Data used to process card payments: name, account number, expiration date, address and CVV code. Regulated by the PCI DSS industry standard.

Question 12

Role-based access control (RBAC)

Accepted Answer

Each user gets a role, and each role gets certain access, like only accountants using payroll software.

Question 13

Rule-based access control (RuBAC)

Accepted Answer

Access is allowed or denied by rules, like no database access outside working hours. Usually layered on another model.

Question 14

Discretionary access control (DAC)

Accepted Answer

Owners decide who can access the objects they own, like sharing a file with one person to edit and another to view. Admins can override.

Question 15

Mandatory access control (MAC)

Accepted Answer

Strict rules, set by an outside administrator, control access by levels given to users and objects, as in military classification.

Question 16

Bell-LaPadula model

Accepted Answer

A MAC model: you can't read objects above your level or write to objects below it. Summed up as "write up, read down."

Question 17

Least privilege

Accepted Answer

Giving every user or program exactly the access it needs to do its job, and no more.

Question 18

Linux file permissions

Accepted Answer

Read (r), write (w) and execute (x), set for the owner, the group and others in that order, like rwxr-x---. A dash means no permission.

Question 19

chmod (numeric)

Accepted Answer

chmod ### file sets owner, group and others with one digit each: read 4, write 2, execute 1. chmod 640 file gives rw-r-----.

Question 20

chmod (symbolic)

Accepted Answer

chmod with u, g, o or a, then + or -, then r, w or x. chmod g+r file adds read for the group; chmod o-w file removes write for others.

Question 21

ls -l and getfacl

Accepted Answer

ls -l shows a file's permissions. A + at the end means extra permissions are set, which you can see with getfacl.

Question 22

Plaintext and ciphertext

Accepted Answer

Plaintext is the readable information you encrypt. Ciphertext is the scrambled output of the encryption algorithm.

Question 23

Symmetric encryption

Accepted Answer

Encryption that uses the same key to encrypt and decrypt. Both sides need that key.

Question 24

Block vs. stream cipher

Accepted Answer

A block cipher encrypts fixed-size chunks of bits. A stream cipher encrypts a continuous flow, one element at a time.

Question 25

AES

Accepted Answer

The Advanced Encryption Standard, the most common symmetric cipher. It encrypts 128-bit blocks and can use different key lengths.

Question 26

OpenSSL

Accepted Answer

A command-line tool that can encrypt and decrypt files with AES or RSA and generate key pairs. AES Crypt is another tool for files.

Question 27

Asymmetric encryption

Accepted Answer

Encryption with a key pair: one key encrypts and only the other can decrypt. It lets people communicate securely without sharing a key first.

Question 28

Public and private keys

Accepted Answer

To send someone a secret, encrypt with their public key; only their private key can decrypt it. If a private key leaks, make a new pair.

Question 29

Key length and keyspace

Accepted Answer

An n-bit key has 2ⁿ possible keys, and random guessing finds it in 2ⁿ⁻¹ guesses on average. Each extra bit doubles the keyspace.

Question 30

Comparing key lengths

Accepted Answer

Compare key lengths only within one algorithm: AES-256 beats AES-128 and RSA-4096 beats RSA-2048, but RSA and AES lengths can't be compared.

Question 31

RSA and ECC

Accepted Answer

Two common asymmetric algorithms, RSA and elliptic curve cryptography. Asymmetric encryption also powers digital signatures and certificates.

Question 32

Secure by design

Accepted Answer

Building security into every phase of making a product. Companies own customers' security outcomes, are open about problems and put security-first leaders in charge.

Question 33

Secure by default

Accepted Answer

Security features come turned on out of the box, so a product is safe to use without extra setup.

Question 34

Control characters

Accepted Answer

Characters an app uses to wrap user input, like the single quote, double quote and semicolon. Attackers slip them into input to change commands.

Question 35

Input sanitization

Accepted Answer

Checking input against what's expected and removing or rejecting dangerous characters. It blocks many SQL injection, XSS and directory traversal attacks.

Question 36

Accounting

Accepted Answer

Recording and monitoring user activity, like who opened, copied, moved or deleted which data. Its logs reveal unusual access.

Question 37

Honeypot

Accepted Answer

A fake file that looks valuable, like fake card numbers. No one should open it, so any access triggers an alert right away.

Question 38

File hash check

Accepted Answer

Hash a file, save the result, and hash it again later. A different hash means the file changed. Tools: sha256sum, Get-FileHash, shasum -a 256.

Question 39

Data loss prevention (DLP)

Accepted Answer

A paid service that watches how data are accessed, used and sent across an organization to catch suspicious activity as it happens.

Question 40

Web log attack indicators

Accepted Answer

Quotes, OR 1=1, -- and SQL words suggest SQL injection; HTML script tags suggest XSS; very long requests suggest buffer overflow; ../ suggests directory traversal.

AP® Cybersecurity Unit 5 flashcardsSecuring Applications and Data

Flashcard drill

Something wrong with this card?